TCP Handshake

What the handshake does

TCP is connection-oriented. Before any application data is sent, both sides must agree on sequence numbers and confirm that the path works in both directions.

That exchange is called the three-way handshake. It moves the session from no state to an established TCP connection.

Effect during attacks

Before the final ACK arrives, the server may already allocate temporary state for the connection attempt. That state can include queue entries, timers and memory.

A SYN flood sends large numbers of SYN packets without completing the handshake, forcing the target to retain state for incomplete sessions.

Affected resources

• Half-open connection tables fill up
• Listen queues become saturated
• State-heavy firewalls waste CPU and memory
• Legitimate users fail to establish new connections

Common defenses

SYN cookies reduce how much temporary state must be stored before the handshake completes. Stateless validation and early packet filtering reduce the number of packets that ever reach the TCP stack.

At high packet rates, connection tracking and traditional firewall state tables can become the limiting factor. Early stateless filtering reduces that load.